CVE-2009-3474

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor…

published September 29, 2009

CVSS
—
EPSS
2%
Percentile
74.8
In the wild
Unconfirmed
What it is

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01544 · 74.8th percentile
Published
2009-09-29T23:00Z
EPSS history
Timeline
  • 29 SEP 23:00Z
    OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor…
    cvelistv5